Application monitoring feature monitors Check Point application's cpd process, so a restart of the cpd process results in Application Monitoring to report the status as "Down".Application Down/UP alarms are seen, but the APM didn't reboot.

Here is an example of the application Down/Up alarms:
-------
Feb 8 12:33:32 Pod10 cbsalarmlogrd: AlarmID 2256 | Sat Feb 8 12:33:32 2014 | info | ap7 | applicationStateChange | Application state change (DOWN)
Feb 8 12:34:32 Pod10 cbsalarmlogrd: AlarmID 2261 | Sat Feb 8 12:34:32 2014 | info | ap7 | applicationStateChange | Application state change (UP)

Feb 8 13:04:30 Pod10 cbsalarmlogrd: AlarmID 2266 | Sat Feb 8 13:04:30 2014 | info | ap4 | applicationStateChange | Application state change (DOWN)
Feb 8 13:05:28 Pod10 cbsalarmlogrd: AlarmID 2272 | Sat Feb 8 13:05:28 2014 | info | ap4 | applicationStateChange | Application state change (UP)
------------

Application Monitoring feature monitors the state of certain application processes and modules. For the Check Point application, application monitoring includes Check Point cpd process. So, if the cpd process is restarted for some reason then the application would go down and come back up and the alarms will be logged as described above.

"rsh" to the vap member that had the application Down/Up alarms, and run the command ps -ef or the command ps -ef |grep cpd to identify if the cpd process was restarted around the time of the alarm.
Here is the output for the example shown:


UID        PID  PPID  C STIME TTY          TIME CMD
root    14902   3455  0 Feb08 ?        00:19:56 cpd         <<<<<<<TIME is accumulative time that the process has been running.



########

If the cpd daemon was restarted, then contact Check Point support to troubleshoot and identify the cause of cpd process restart.